Analyzing TLS Configuration

Overview

This skill audits a target's TLS posture against current best practice (NIST SP 800-52r2, Mozilla TLS Configuration Guidelines, PCI DSS v4.0 Req 4.2.1.1). It reports specific findings — not "your TLS is weak" but "your server negotiated TLSv1.0 with RC4-SHA — see remediation".

When the skill produces findings

Specific failure thresholds, in order of severity:

Finding	Severity	Threshold	Affected control
TLSv1.0 or TLSv1.1 negotiated	HIGH	Any handshake completes at v1.0/v1.1	NIST 800-52r2 §3.1, PCI DSS Req 4.2.1.1
Null / EXPORT / anonymous cipher	CRITICAL	Any null / EXPORT / aNULL in negotiated suite	NIST 800-52r2 §3.3.1
RC4 / 3DES cipher	HIGH	Sweet32, RC4 biases	NIST 800-52r2 §3.3.1, PCI DSS Req 4.2.1.1
Cert expires in <7 days	CRITICAL	notAfter - now ≤ 7d	NIST 800-52r2 §4.1
Cert expires in <30 days	HIGH	notAfter - now ≤ 30d	NIST 800-52r2 §4.1
Cert hostname mismatch	HIGH	SAN/CN doesn't match target host	RFC 6125
Self-signed or untrusted CA	MEDIUM	Chain doesn't validate to system CA	Mozilla TLS Guidelines
Weak key (RSA < 2048, ECDSA < 256)	HIGH	Public key bits below threshold	NIST 800-52r2 §3.4
Forward secrecy absent	MEDIUM	No ECDHE / DHE in negotiated suite